Browse our curated list of Web Penetration Testing Companies
VAPT testing cost in India runs from about $420 to $2,100 for one web application. A SaaS product with the web app, APIs and cloud set-up tested together costs $1,600 to $4,200, while an enterprise or compliance-led programme starts around $5,300 and can pass $21,000. A quote under roughly $260 is usually an automated scan rather than a real penetration test. Dollar figures are converted from Indian rupees at about 95 to the US dollar[1].
This guide is for whoever signs the purchase order. That might be a CTO preparing for a bank's security review in London, a compliance head at a fintech in Mumbai, or a founder in Dubai whose enterprise customer has just asked for a pen test report. Below you'll find prices by scope, app complexity, company size and industry. After that come the pricing models you're likely to be offered, the rules that decide how often you test, and what the same work would cost in-house or with a firm in the US or UK.
Key takeaways
- Expect to pay $420 to $2,100 to test one web app in India. The lowest figure in the four 2026 price lists we compared was $320 for a small app, and the highest was $5,300 for a complex one.
- The price follows the scope. How many user roles, API endpoints, IP addresses and cloud accounts you have matters far more than how big your company is.
- RBI-regulated banks and NBFCs must penetration-test critical systems at least every 12 months[2], and PCI DSS asks the same of anyone handling card data[3].
- The 6 web penetration testing companies listed on UpBusiness report average projects from $530 to $26,300, with a median of $10,500. All six are full-service software firms that test alongside larger builds.
What a VAPT Includes
VAPT is really two pieces of work sold under one name. The vulnerability assessment is mostly tool-driven: scanners check your web app, servers and cloud settings against known weaknesses and produce a long list, often in a day or two. The penetration test is where a person takes that list, tries to exploit what's real, chains small issues together and attempts to reach data or functions they shouldn't. That second part finds the problems scanners can't see, such as a customer being able to open another customer's invoice by changing a number in the URL.
Almost all of the cost sits in the manual testing, so the first question to ask about any quote is how many tester-days of hands-on work it includes. A report that is mostly scanner output can look thorough and still miss the access-control and business-logic flaws that attackers go after first.
VAPT Testing Cost in India by Scope (2026)
Testers price by the effort a target needs, and a login-protected app with five user roles takes far longer to test properly than a brochure site with the same number of pages. So the table below goes by what's being tested, not by who's buying.
| What's tested | Planning range | Full published spread | Usual testing time |
|---|---|---|---|
| Automated vulnerability scan only | $210–530 | $210–530 | Not a penetration test |
| One web application | $420–2,100 | $320–5,300 | 1–3 weeks |
| Mobile app, per platform | $420–1,600 | $420–2,100+ | 4–8 days |
| API | $320–1,300 | $320–2,600+ | 3–7 days |
| External network | $320–1,050 | $320–3,200 | Depends on public IPs |
| Internal network | $630–2,100 | $630–2,100+ | Depends on hosts and Active Directory |
| Cloud configuration review | $790–2,100 | $530–5,300+ | Per environment |
| SaaS bundle: web app, APIs and cloud | $1,600–4,200 | $1,600–4,200 | 4–8 weeks for multi-asset scopes |
| Enterprise or compliance programme | $5,300–21,000+ | $3,200–21,000+ | 3–8 weeks |
The full spread shows how far the four published price lists stretch. Its top end usually describes a large app, several environments or compliance-grade reporting.
Website and Web App VAPT Cost by Complexity
Quotes for single web apps vary more than for anything else on this list. Two of the four price lists already break them down by size[4][5], and lining them up gives three bands you can place your own app in.
| Band | What usually puts an app here | Price | Testing time |
|---|---|---|---|
| Simple | A small site or portal, one or two user roles, no payments, few forms | $320–840 | 3–5 days |
| Medium | Logins with two to five roles, payments or file uploads, an API behind the front end | $840–2,100 | 5–10 days |
| Complex | Multi-tenant SaaS, single sign-on, five or more roles, admin panels and integrations | $2,100–5,300 | 10–20 days |
If you can't tell which band you're in, count the user roles and the API endpoints before you ask for quotes. Those two numbers move the tester-days more than anything else. Give them up front and partner companies have no reason to pad the quote with a safety margin.
Here's the arithmetic for one example. Say you run a B2B portal with three user roles, about 40 API endpoints and online payments. A careful tester will want roughly a day to map the app and set up test accounts, four to six days of hands-on testing across the roles and the API, a day to write the report and up to a day for the retest after your developers have fixed things. That's seven to nine tester-days. If you divide the medium-band prices above by the testing time quoted alongside them, you get somewhere around $160 to $210 per tester-day, which puts this portal at about $1,100 to $1,900. A $370 quote for the same app can't hold more than two or three days of work, so ask the firm which part of the job it has left out.
How We Calculated These VAPT Prices
We collected the 2026 price lists published by four Indian security firms[6][7][4][5], all dated between June and August 2026. Then we put every row for the same scope side by side. The planning range leans on the low and middle part of where the lists overlap, because the higher figures usually describe bigger scopes than the row label suggests. We kept the scan-only row because it's what many cheap "VAPT" quotes actually are, and we converted rupees to dollars at about 95 to 1.
Every one of these lists comes from a firm that sells testing, and none of them is fully consistent with itself. One gives a website test as $630 to $840 in a table and $630 to $1,600 in its FAQ[5], while another puts a small web app at three to five days in one section and three to seven in another[4]. That's one reason we've set these figures beside what partner companies on UpBusiness report about their own project sizes, further down.
VAPT Cost by Company Size and Industry
Company size doesn't set the price directly, but it's a fair predictor of scope. A 20-person startup often needs just one app tested. A bank needs dozens of systems, an internal network and a report its regulator will accept. Two of the published lists give ranges by company size, and they're far enough apart that we've shown both.
| Company size | First list[4] | Second list[5] | What usually gets tested |
|---|---|---|---|
| Startup or small business | $320–1,600 | $630–5,300+ | One web app, sometimes a mobile app |
| Mid-size company | $1,600–5,300 | $2,100–15,800+ | Web apps, APIs, cloud and the external network |
| Enterprise | $5,300–21,000+ | $8,400–52,600+ | A full programme, including internal network and Active Directory |
Industry works the same way, through the rules each sector has to meet. The industry ranges below come from one firm's list[4], so treat them as a rough guide to the yearly budget rather than a quote.
| Industry | Yearly VAPT budget in India | Rule that usually drives the scope |
|---|---|---|
| Banking and finance | $5,300–26,300 | RBI, SEBI and PCI DSS |
| Government and PSUs | $5,300–21,000 | CERT-In empanelled auditor |
| Manufacturing and OT | $3,200–15,800 | IEC 62443 |
| IT and SaaS | $2,100–10,500 | ISO 27001 and SOC 2 |
| Healthcare | $2,100–8,400 | DPDP Act, plus HIPAA for US patient data |
| E-commerce | $1,600–6,300 | PCI DSS and the DPDP Act |
Why VAPT Quotes for the Same App Differ So Much
Getting three quotes for the same app that differ by four or five times is normal, and it's rarely random. Usually the gap comes down to what's actually included, and five things account for most of it:
- The share of manual work. A scanner export with a new cover page is cheap to produce, and it misses the access-control and business-logic flaws that a person finds.
- Authenticated testing, where the tester logs in with each user role and tries to reach what that role shouldn't see. Some low quotes only test the login page from outside.
- Retests after you fix the findings, and whether a clean attestation letter comes at the end
- The people doing the work. Ask for the tester-days and their seniority, since the certificates on a company's website don't tell you who'll actually be assigned.
- A CERT-In empanelled auditor, if your regulator needs one, which narrows the field and usually raises the price
Be wary of a price that arrives within the hour, before anyone has asked how many user roles you have, because nothing has been scoped yet. A report promised in two days for a complex app is almost certainly scanner output. And a pitch built around "zero false positives" usually describes the tool rather than the testers. What you want from a person is a list of confirmed findings and an honest note of what they didn't manage to test.
To compare quotes fairly, ask every partner company for the same four numbers: tester-days, the share of manual testing, retest rounds included, and a redacted sample report from a similar engagement.
For a sense of the downside, IBM's 2025 study put the average cost of a data breach in India at $2.3 million. In 13% of the breaches it looked at, the attackers got in by exploiting a vulnerability[8]. Against a number like that, saving $530 by choosing a test that skips the manual work is hard to justify, especially for a product that holds customer data.
VAPT Pricing Models: Fixed Price, Day Rate, Retainer or Subscription
Quotes for a single app are usually fixed price, but the same test can be sold in three other ways, and bigger buyers are often offered them. Each model changes what you're really paying for, so check which one a quote uses before you compare it with the others.
| Model | How it's priced | Suits | Watch for |
|---|---|---|---|
| Fixed price | One figure for an agreed scope | One-off tests of a known app or network | What's excluded, and how many retests are included |
| Day rate | Tester-days multiplied by a daily rate | Open-ended or hard-to-scope work | Ask for a cap, or the bill can grow with the findings |
| Retainer or bucket of days | A block of days bought up front and used through the year | Teams that release often and test several times a year | Unused days usually expire |
| Subscription | A yearly plan with continuous scanning and scheduled manual tests | SaaS teams shipping every week | How deep the manual test is, and how many expert rescans you get |
Subscription providers are one of the few places you'll see a VAPT price on a public page. One lists $2,999 a year for an autonomous-only plan and $5,999 a year for a plan that adds a manual pen test by certified testers with two expert rescans[9]. If a fixed-price quote for one app costs more than a whole year of that, you're entitled to ask what extra depth you're getting.
Which Rules Require a VAPT, and How Often
The rules below are the main ones that set a testing schedule, and each links to the official text or a circular that quotes it.
| If you are | What the rule asks for | Who can test |
|---|---|---|
| An Indian bank or NBFC regulated by the RBI | Vulnerability assessment at least every six months and penetration test at least every 12 months for critical systems and customer-facing systems in the DMZ[2] | Qualified testers; check your RBI category |
| A SEBI-regulated entity (most categories) | VAPT once a year, planned at the start of the financial year, with the report and closure report filed on set dates[10] | A CERT-In empanelled auditor[11] |
| Any business that stores, processes or transmits card data | Internal and external penetration tests at least every 12 months and after significant infrastructure or application changes (PCI DSS v4.0.1, requirements 11.4.2 and 11.4.3)[3] | Qualified internal or independent external testers |
| A larger EU bank, insurer or other financial entity named by its regulator | Threat-led penetration testing at least every three years under DORA[12] | Testers meeting the DORA criteria |
| Supplying IT to UK government | Penetration tests on many public-sector systems through the NCSC's CHECK scheme[13] | CHECK companies |
SOC 2, ISO 27001 and the DPDP Act
None of these three names a penetration test as a hard requirement, and that's where a lot of SaaS buyers get confused. In SOC 2, penetration testing appears in the points of focus for criterion CC4.1 as one of the ways to evaluate your controls[14], and points of focus are examples rather than rules. Many SaaS teams run one anyway, because auditors and enterprise customers tend to accept a pen test report more readily than scan results. ISO 27001 asks you to manage technical vulnerabilities (control 8.8 in the 2022 edition)[15] without saying how, and a yearly VAPT is a common way to show you do.
India's Digital Personal Data Protection Act requires every data fiduciary to take reasonable security safeguards to prevent a personal data breach (section 8(5)). Failing at that can draw a penalty of up to $26.3 million[16]. The Act doesn't mention VAPT, but a recent test report with closed findings is one of the clearest records you can keep that your safeguards were checked.
Plenty of companies outside these rules still test every year, usually because someone has asked to see a report. It might come from an enterprise customer's security questionnaire, a cyber-insurance renewal or an investor doing due diligence before a funding round. In those cases, test once a year and again after big releases, and ask the partner company to scope the test around what your customers actually worry about.
VAPT Cost in India vs Testing In-House or Onshore in the US or UK
If you're buying from outside India, you'll probably weigh an Indian quote against two alternatives. The table below shows what an international security firm charges, and what one tester-day costs if you hire your own analyst. Read the in-house numbers as the least it could cost you. They only count pay and employer costs, and leave out hiring, tools and management time.
| Option | Cost per tester-day | Basis | A 10-day web app test |
|---|---|---|---|
| Indian security partner company | Built into the quote | Published Indian price lists[6][4] | $420–2,100 for the whole engagement |
| International security firm | Built into the quote | One firm's 2026 price guide for SaaS and web app tests[17] | $5,000–30,000 |
| In-house analyst, US | About $710 | Median information security analyst pay of $129,180 in May 2025[18], with benefits at 30% of employer costs[19], over 2,080 hours | About $7,100 |
| In-house analyst, UK | About £255 (~$335) | Median full-time pay of £54,647 for cyber security professionals (ASHE 2025, provisional)[20] plus 15% employer National Insurance above £5,000[21], over 1,950 hours | About £2,550 (~$3,360) |
This isn't a like-for-like swap, since an in-house analyst also covers monitoring, patching and incident response all year. Where an Indian partner company tends to win is the scheduled, independent test a regulator, auditor or customer asks for. Independence is the whole point of that test, and you only need it once or twice a year. UK pay is converted at about $1.32 to the pound.
What a Good VAPT Report Should Contain
The report is the thing you're paying for, and the one you'll forward to auditors and customers, so ask for a redacted sample before you sign. A useful one includes:
- The exact scope tested (URLs, IP ranges, app versions, user roles) and what was left out
- The method used, such as the OWASP Testing Guide or NIST SP 800-115, and the dates of testing
- Each finding with a severity score, the steps to reproduce it, evidence such as screenshots, and a fix your developers can act on
- A one- or two-page summary your management can read without a security background, saying in business terms what's at risk
- A retest section showing which findings are closed, and a closure or attestation letter you can share with customers
The method list in SEBI's VAPT reporting format includes CERT-In guidelines, NIST SP 800-115, ISO 27001, PCI DSS, OSSTMM and the OWASP Testing Guide[10], which is a sensible checklist even if SEBI doesn't regulate you.
GST, Contracts and Data for Buyers Outside India
If your company is outside India, a partner company that has filed a Letter of Undertaking can usually bill the test without GST, because Indian law treats an export of services as zero-rated[22]. Indian buyers should expect 18% GST on top of the quote.
Get the paperwork signed before anyone starts testing. You'll want an authorisation letter that names the systems and the dates and hours testers may work, a confidentiality clause covering the findings and any data they see along the way, and a written agreement on where evidence and reports are kept and when they get deleted. Our software development contract checklist lists the data-processing terms Indian law expects, and the same clauses work for a testing contract.
What UpBusiness Data Shows
Our analysis of the 6 approved web penetration testing companies on UpBusiness in October 2026 found average projects ranging from $530 to $26,300, with a median of $10,500. Their median minimum project is $4,000, the smallest minimum is $260, and five of the six take on projects of $52,600 or more.
| What the 6 partner companies report | October 2026 |
|---|---|
| Average project size | $530 and $1,050 (2 companies), $10,500 (2), $26,300 (2) |
| Median minimum project | $4,000 |
| Team size | 1–10 people (1), 11–50 (2), 51–200 (2), 201–500 (1) |
| Where they're based | Noida (4), Ahmedabad (1), Mumbai (1) |
| Founded | Between 2004 and 2024 |
| TrustScore | 70.2–75.9 |
These figures sit well above the single-app band because all six are full-service software firms, and their project sizes cover development work as well as testing. The wider cybersecurity category has 7 companies, and they lean towards mid-market clients (60%, with small businesses at 35% and enterprises at 5%), naming healthcare, manufacturing and fintech most often. One security firm there lists a black-box VAPT for a client at $530 to $1,050 over about three weeks (self-reported, still awaiting client verification), which lands right in the single-application band.
For a scheduled test of one app, ask for a fixed-scope quote and check that the testers are on the firm's own staff rather than subcontracted. If you'd rather test as you build, these firms can add security checks to each release, and our guide to CI/CD implementation shows how that pipeline is set up. If your regulator needs a CERT-In empanelled auditor, check the firm's name on CERT-In's own list before you sign[11].
How to Get an Accurate VAPT Quote
Testers can only price what they can see, and a vague request ("please quote for VAPT of our app") gets a range so wide it's no help. Send each partner company the same pack:
- The list of targets: URLs, apps (with platforms), API documentation, public IP ranges and cloud accounts
- The user roles to test and whether you'll provide test accounts
- The rule or customer request behind the test, and your deadline for the report
- Whether testing can run on production, and the hours when it's allowed
If the budget is tight, cut the scope before you cut the depth. A manual test of the one app your customers log into is worth more than a scan of everything you own, and the rest can be tested next year once the most exposed system is in good shape.
Book the work six to eight weeks before any audit or regulator deadline, because fixing the findings and running the retest often take longer than the test itself. Our software project brief template has room for all of this, and our guide to comparing proposals line by line works just as well for security quotes. If you sell software to businesses, our SaaS security checklist shows what enterprise customers tend to ask for alongside the report.
Find VAPT Partner Companies on UpBusiness
You can compare verified web penetration testing companies and cybersecurity companies on UpBusiness by TrustScore, project size, team size and industry, then shortlist the ones that fit. If you'd rather they came to you, post your project with your scope, deadline and the rule you're testing for, and we'll match it with partner companies that work at that size.
